@axiom-lattice/gateway 6.0.1 → 6.1.0

package/dist/index.mjs

@@ -2678,13 +2678,13 @@ async function searchEntries(request, reply) {
 
 // src/controllers/tools.ts
 import { toolLatticeManager } from "@axiom-lattice/core";
-function serializeSchema(schema) {
-  if (!schema) {
+function serializeSchema(schema2) {
+  if (!schema2) {
     return void 0;
   }
   try {
-    if (schema._def) {
-      const def = schema._def;
+    if (schema2._def) {
+      const def = schema2._def;
       if (def.typeName === "ZodObject") {
         const shape = def.shape();
         const properties = {};
@@ -2710,7 +2710,7 @@ function serializeSchema(schema) {
     }
     return {
       type: "object",
-      description: schema.description || "Schema definition"
+      description: schema2.description || "Schema definition"
     };
   } catch (error) {
     return {
@@ -11401,7 +11401,50 @@ function registerA2ABridgeRoutes(app2) {
 }
 
 // src/routes/stt.ts
-import { getSTTClient, sttModelLatticeManager } from "@axiom-lattice/core";
+import { sttModelLatticeManager } from "@axiom-lattice/core";
+
+// src/controllers/tenant-scope.ts
+var TenantScopeError2 = class extends Error {
+  /** Creates a tenant scope error. */
+  constructor(code, statusCode, message) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "TenantScopeError";
+  }
+};
+function resolveTenantScope(request, authRequired2) {
+  const authenticated = request.user?.tenantId;
+  const header2 = request.headers["x-tenant-id"];
+  const requested = Array.isArray(header2) ? header2[0] : header2;
+  if (authenticated) {
+    if (requested && requested !== authenticated) {
+      throw new TenantScopeError2(
+        "TENANT_ACCESS_DENIED",
+        403,
+        "Tenant access denied"
+      );
+    }
+    return { tenantId: authenticated, userId: request.user?.id };
+  }
+  if (authRequired2) {
+    throw new TenantScopeError2(
+      "UNAUTHENTICATED",
+      401,
+      "Console session required"
+    );
+  }
+  return { tenantId: requested || "default" };
+}
+
+// src/routes/stt.ts
+function tenantIdOf(request) {
+  try {
+    return resolveTenantScope(request, false).tenantId;
+  } catch {
+    return "default";
+  }
+}
 var ALLOWED_AUDIO_FORMATS = /* @__PURE__ */ new Set([
   "webm",
   "wav",
@@ -11455,10 +11498,11 @@ var registerSTTRoutes = (app2) => {
         return reply.status(400).send({ error: `Unsupported audio format: ${format}` });
       }
       try {
-        let client;
-        try {
-          client = getSTTClient(modelKey2);
-        } catch {
+        const client = await sttModelLatticeManager.getSTTClientWithTenantAsync(
+          tenantIdOf(request),
+          modelKey2
+        );
+        if (!client) {
           return reply.status(404).send({ error: `STT model "${modelKey2}" not found` });
         }
         const result = await client.transcribe(buffer, format);
@@ -11752,6 +11796,9 @@ function registerTaskRoutes(app2, controller) {
 import {
   agentInstanceManager as agentInstanceManager6,
   agentLatticeManager as agentLatticeManager4,
+  embeddingsLatticeManager as embeddingsLatticeManager2,
+  sttModelLatticeManager as sttModelLatticeManager2,
+  vectorStoreLatticeManager,
   createProjectTaskReassignmentAuthorizer,
   createTaskLifecycleService,
   createTrustedAgentMessageDispatcher,
@@ -15721,6 +15768,7 @@ import { toModelKey } from "@axiom-lattice/protocols";
 import {
   assertSafeUpstreamUrl,
   buildModelLlmConfig,
+  DEFAULT_MODEL_EXTRA,
   UnsupportedModelProviderError,
   UnsafeUpstreamUrlError
 } from "@axiom-lattice/core";
@@ -15763,13 +15811,48 @@ function resolveDiscoveryTimeoutMs(raw = process.env.LATTICE_MODEL_DISCOVERY_TIM
   return parsed;
 }
 function buildModelsEndpoint(baseURL) {
+  return buildOpenAiEndpoint(baseURL, "models");
+}
+function buildOpenAiEndpoint(baseURL, path5) {
   const url = new URL(baseURL);
   const trimmed = url.pathname.replace(/\/+$/, "");
-  url.pathname = trimmed.endsWith("/v1") ? `${trimmed}/models` : `${trimmed}/v1/models`;
+  url.pathname = /\/v\d+$/.test(trimmed) ? `${trimmed}/${path5}` : `${trimmed}/v1/${path5}`;
   url.search = "";
   url.hash = "";
   return url.toString();
 }
+function assertUpstreamOk(response) {
+  if (response.status >= 300 && response.status < 400) {
+    throw new ModelProviderServiceError(
+      "UPSTREAM_REDIRECT_BLOCKED",
+      502,
+      "Upstream returned a redirect; configure the final URL directly"
+    );
+  }
+  if (response.status === 401 || response.status === 403) {
+    throw new ModelProviderServiceError(
+      "UPSTREAM_AUTH_FAILED",
+      502,
+      "Upstream rejected the configured credentials"
+    );
+  }
+  if (response.status === 429) {
+    throw new ModelProviderServiceError(
+      "UPSTREAM_RATE_LIMITED",
+      502,
+      "Upstream rate limited the request",
+      true
+    );
+  }
+  if (!response.ok) {
+    throw new ModelProviderServiceError(
+      "UPSTREAM_UNREACHABLE",
+      502,
+      "Upstream returned an error response",
+      response.status >= 500
+    );
+  }
+}
 function parseModelsPayload(payload) {
   const entries = Array.isArray(payload) ? payload : typeof payload === "object" && payload !== null ? payload.data : void 0;
   if (!Array.isArray(entries)) {
@@ -15840,36 +15923,60 @@ var openAiCompatibleAdapter = {
         true
       );
     }
-    if (response.status >= 300 && response.status < 400) {
-      throw new ModelProviderServiceError(
-        "UPSTREAM_REDIRECT_BLOCKED",
-        502,
-        "Upstream returned a redirect; configure the final URL directly"
-      );
-    }
-    if (response.status === 401 || response.status === 403) {
-      throw new ModelProviderServiceError(
-        "UPSTREAM_AUTH_FAILED",
-        502,
-        "Upstream rejected the configured credentials"
-      );
-    }
-    if (response.status === 429) {
+    assertUpstreamOk(response);
+    const body = await readBodyWithLimit(response, MAX_RESPONSE_BYTES);
+    let payload;
+    try {
+      payload = JSON.parse(body);
+    } catch {
       throw new ModelProviderServiceError(
-        "UPSTREAM_RATE_LIMITED",
+        "UPSTREAM_INVALID_RESPONSE",
         502,
-        "Upstream rate limited the request",
-        true
+        "Upstream response was not valid JSON"
       );
     }
-    if (!response.ok) {
+    return parseModelsPayload(payload);
+  }
+};
+async function probeEmbeddingInference(input, signal) {
+  const startedAt = Date.now();
+  const endpoint = buildOpenAiEndpoint(input.baseURL, "embeddings");
+  const headers = {
+    Accept: "application/json",
+    "Content-Type": "application/json"
+  };
+  if (input.apiKey) {
+    headers.Authorization = `Bearer ${input.apiKey}`;
+  }
+  try {
+    let response;
+    try {
+      response = await fetch(endpoint, {
+        method: "POST",
+        headers,
+        // Never follow redirects: a redirected request could reach an address
+        // that bypassed the SSRF checks.
+        redirect: "manual",
+        signal,
+        body: JSON.stringify({ model: input.modelId, input: "ping" })
+      });
+    } catch (error) {
+      if (error instanceof Error && error.name === "AbortError") {
+        throw new ModelProviderServiceError(
+          "UPSTREAM_TIMEOUT",
+          504,
+          "Upstream did not respond in time",
+          true
+        );
+      }
       throw new ModelProviderServiceError(
         "UPSTREAM_UNREACHABLE",
         502,
-        "Upstream returned an error response",
-        response.status >= 500
+        "Upstream could not be reached",
+        true
       );
     }
+    assertUpstreamOk(response);
     const body = await readBodyWithLimit(response, MAX_RESPONSE_BYTES);
     let payload;
     try {
@@ -15881,9 +15988,37 @@ var openAiCompatibleAdapter = {
         "Upstream response was not valid JSON"
       );
     }
-    return parseModelsPayload(payload);
+    return {
+      reachable: true,
+      latencyMs: Date.now() - startedAt,
+      dimensions: readEmbeddingDimensions(payload)
+    };
+  } catch (error) {
+    if (error instanceof ModelProviderServiceError && isUpstreamErrorCode(error.code)) {
+      return {
+        reachable: false,
+        latencyMs: Date.now() - startedAt,
+        error: error.code
+      };
+    }
+    throw error;
   }
-};
+}
+function readEmbeddingDimensions(payload) {
+  if (typeof payload !== "object" || payload === null) {
+    return void 0;
+  }
+  const data = payload.data;
+  if (!Array.isArray(data) || data.length === 0) {
+    return void 0;
+  }
+  const first = data[0];
+  if (typeof first !== "object" || first === null) {
+    return void 0;
+  }
+  const embedding = first.embedding;
+  return Array.isArray(embedding) ? embedding.length : void 0;
+}
 async function readBodyWithLimit(response, maxBytes) {
   if (!response.body) {
     return response.text();
@@ -15985,6 +16120,9 @@ var ModelProviderService = class {
     }
     const models = snapshot.map((model) => ({
       modelKey: toModelKey(model.providerId, model.modelId),
+      // What this row can do. Pickers filter on it, so it travels with every
+      // entry rather than being re-derived by each consumer.
+      kind: model.kind,
       displayName: model.displayName,
       providerId: model.providerId,
       providerName: providerNames.get(model.providerId) ?? model.providerId,
@@ -16012,6 +16150,9 @@ var ModelProviderService = class {
           // which is how the deployment's `default` alias came to be offered as
           // a model literally called "default".
           displayName: config.displayName || config.model || modelKey2,
+          // Deployment-registered models are chat by construction: they are
+          // built with `registerModelLattice`, which only mints LLM clients.
+          kind: "chat",
           providerId: "",
           providerName: "registered",
           source: "registered",
@@ -16065,6 +16206,8 @@ var ModelProviderService = class {
    * left untouched.
    */
   async reconcileProvider(tenantId, providerId2) {
+    this.deps.registry.evictProviderCache?.(tenantId, providerId2);
+    this.deps.registry.forgetTenantDefaultMiss?.(tenantId);
     if (!this.shouldRegister(tenantId)) {
       return;
     }
@@ -16074,21 +16217,9 @@ var ModelProviderService = class {
     }
     const provider = await this.deps.providerStore.getProviderById(tenantId, providerId2);
     if (!provider) {
-      const prefix = `${providerId2}/`;
-      for (const { modelKey: modelKey2 } of this.deps.registry.listRegistered(tenantId)) {
-        if (modelKey2.startsWith(prefix)) {
-          this.deps.registry.remove(tenantId, modelKey2);
-        }
-      }
       return;
     }
     const models = await this.deps.providerStore.listModels(tenantId, providerId2);
-    const current = new Set(models.map((model) => toModelKey(providerId2, model.modelId)));
-    for (const { modelKey: modelKey2 } of this.deps.registry.listRegistered(tenantId)) {
-      if (modelKey2.startsWith(`${providerId2}/`) && !current.has(modelKey2)) {
-        this.deps.registry.remove(tenantId, modelKey2);
-      }
-    }
     this.syncRegistry(tenantId, provider, models);
   }
   /**
@@ -16187,11 +16318,9 @@ var ModelProviderService = class {
   async remove(userId, tenantId, id3) {
     await this.assertAdmin(userId, tenantId);
     await this.requireProvider(tenantId, id3);
-    const snapshot = await this.deps.providerStore.listModels(tenantId, id3);
     await this.deps.providerStore.deleteProvider(tenantId, id3);
-    for (const model of snapshot) {
-      this.deps.registry.remove(tenantId, toModelKey(id3, model.modelId));
-    }
+    this.deps.registry.evictProviderCache?.(tenantId, id3);
+    this.deps.registry.forgetTenantDefaultMiss?.(tenantId);
     this.notifyChanged(tenantId, id3);
   }
   /**
@@ -16221,7 +16350,8 @@ var ModelProviderService = class {
       () => controller.abort(),
       resolveDiscoveryTimeoutMs()
     );
-    const previous = this.shouldRegister(tenantId) ? await this.deps.providerStore.listModels(tenantId, id3) : [];
+    const previous = await this.deps.providerStore.listModels(tenantId, id3);
+    const previousIds = new Set(previous.map((model) => model.modelId));
     let discovered;
     try {
       discovered = await adapter.discover({
@@ -16247,7 +16377,12 @@ var ModelProviderService = class {
     const inserted = await this.deps.providerStore.replaceProviderModels(
       tenantId,
       id3,
-      discovered
+      discovered.map((model) => ({
+        ...model,
+        // Same rule as `setModels`: a row this provider just brought in starts
+        // with the default config, a row already stored keeps the tenant's.
+        extra: previousIds.has(model.id) ? void 0 : { ...DEFAULT_MODEL_EXTRA }
+      }))
     );
     await this.deps.providerStore.markProviderStatus(
       tenantId,
@@ -16321,6 +16456,30 @@ var ModelProviderService = class {
       resolveDiscoveryTimeoutMs()
     );
     const startedAt = Date.now();
+    if (input.kind === "embedding") {
+      if (!input.modelId) {
+        throw new ModelProviderServiceError(
+          "INVALID_INPUT",
+          400,
+          "An embedding probe needs a model id"
+        );
+      }
+      try {
+        const outcome = await probeEmbeddingInference(
+          { baseURL: input.baseURL, apiKey, modelId: input.modelId },
+          controller.signal
+        );
+        return {
+          reachable: outcome.reachable,
+          latencyMs: outcome.latencyMs,
+          models: [],
+          ...outcome.dimensions === void 0 ? {} : { dimensions: outcome.dimensions },
+          ...outcome.error ? { error: outcome.error } : {}
+        };
+      } finally {
+        clearTimeout(timeout);
+      }
+    }
     try {
       const models = await adapter.discover({
         baseURL: input.baseURL,
@@ -16385,8 +16544,13 @@ var ModelProviderService = class {
         ownedBy: previousById.get(entry.modelId)?.ownedBy,
         // An omitted `extra` means "keep what is stored" — the picker sends no
         // config, and a sync must not wipe one set by hand. The store resolves
-        // the fallback against the row's current value.
-        extra: entry.extra,
+        // the fallback against the row's current value. A model that is not
+        // stored at all gets the default config rather than an empty one.
+        extra: entry.extra ?? (previousById.has(entry.modelId) ? void 0 : { ...DEFAULT_MODEL_EXTRA }),
+        // Omitted means "keep the stored kind"; the store defaults a new row
+        // to chat. A picker that only toggles `enabled` therefore cannot
+        // accidentally reclassify a model.
+        kind: entry.kind,
         // Same rule: omitted leaves the flag alone, so a sync cannot quietly
         // move the tenant's default.
         isDefault: entry.isDefault
@@ -16409,14 +16573,17 @@ var ModelProviderService = class {
     return this.toPublicEntry(provider, models.length);
   }
   /**
-   * Give a tenant's sole model the default flag.
+   * Give a tenant's sole **chat** model the default flag.
    *
-   * A tenant with exactly one runnable model has an obvious default, and saying
-   * so is what keeps the invariant the rest of the feature leans on: a tenant
-   * either has no models at all — and falls back to the deployment's default —
-   * or has a default, which cannot be deleted. Without this a tenant could sit
-   * with one model and no default, and deleting that model would leave nothing
-   * behind.
+   * A tenant with exactly one runnable chat model has an obvious default, and
+   * saying so is what keeps the invariant the rest of the feature leans on: a
+   * tenant either has no chat model at all — and falls back to the deployment's
+   * default — or has a default, which cannot be deleted. Without this a tenant
+   * could sit with one model and no default, and deleting that model would
+   * leave nothing behind.
+   *
+   * Chat only: a bare `"default"` key resolves to a chat client, so an
+   * embedding or ASR row must never be marked as one.
    *
    * Deliberately narrow: more than one model is the tenant's choice to make,
    * and a disabled model is not a candidate for "the model this tenant runs".
@@ -16425,24 +16592,33 @@ var ModelProviderService = class {
    */
   async ensureDefaultModel(tenantId) {
     const models = await this.deps.providerStore.listModels(tenantId);
-    if (models.length !== 1) {
+    const chatModels = models.filter((model) => model.kind === "chat");
+    if (chatModels.length !== 1) {
       return;
     }
-    const [only] = models;
+    const [only] = chatModels;
     if (only.isDefault || !only.enabled) {
       return;
     }
-    await this.deps.providerStore.replaceProviderModels(tenantId, only.providerId, [
-      {
-        id: only.modelId,
-        enabled: only.enabled,
-        stale: only.stale,
-        extra: only.extra,
-        isDefault: true
-      }
-    ]);
+    const siblings = models.filter(
+      (model) => model.providerId === only.providerId
+    );
+    await this.deps.providerStore.replaceProviderModels(
+      tenantId,
+      only.providerId,
+      siblings.map((model) => ({
+        id: model.modelId,
+        enabled: model.enabled,
+        stale: model.stale,
+        extra: model.extra,
+        kind: model.kind,
+        isDefault: model.modelId === only.modelId
+      }))
+    );
   }
   syncRegistry(tenantId, provider, models) {
+    this.deps.registry.evictProviderCache?.(tenantId, provider.id);
+    this.deps.registry.forgetTenantDefaultMiss?.(tenantId);
     if (!this.shouldRegister(tenantId)) {
       return [];
     }
@@ -16689,6 +16865,10 @@ var setModelsSchema = z9.object({
       // Omitted means "leave the stored config alone" — the picker sends
       // only ids and states, and must not wipe a config set by hand.
       extra: extraSchema.optional(),
+      // What this model does. Omitted means "leave the stored kind
+      // alone"; a new row defaults to chat. The kinds are independent —
+      // each has its own runtime lattice and loader guard.
+      kind: z9.enum(["chat", "embedding", "asr"]).optional(),
       // At most one per tenant; the service rejects a tie with a
       // readable error rather than letting the unique index raise one.
       // Omitted means "leave the stored flag alone", which is what a
@@ -16701,43 +16881,13 @@ var probeProviderSchema = z9.object({
   baseURL: z9.string().trim().min(1).max(2048),
   apiKey: z9.string().max(1024).optional(),
   providerId: z9.string().trim().min(1).max(255).optional(),
-  protocol: protocolSchema.optional()
+  protocol: protocolSchema.optional(),
+  // Only an embedding probe uses these: it names the model and asks for one
+  // inference, because a model list cannot prove a model can embed.
+  kind: z9.enum(["chat", "embedding", "asr"]).optional(),
+  modelId: z9.string().trim().min(1).max(512).optional()
 }).strict();
 
-// src/controllers/tenant-scope.ts
-var TenantScopeError2 = class extends Error {
-  /** Creates a tenant scope error. */
-  constructor(code, statusCode, message) {
-    super(message);
-    this.code = code;
-    this.statusCode = statusCode;
-    this.name = "TenantScopeError";
-  }
-};
-function resolveTenantScope(request, authRequired2) {
-  const authenticated = request.user?.tenantId;
-  const header2 = request.headers["x-tenant-id"];
-  const requested = Array.isArray(header2) ? header2[0] : header2;
-  if (authenticated) {
-    if (requested && requested !== authenticated) {
-      throw new TenantScopeError2(
-        "TENANT_ACCESS_DENIED",
-        403,
-        "Tenant access denied"
-      );
-    }
-    return { tenantId: authenticated, userId: request.user?.id };
-  }
-  if (authRequired2) {
-    throw new TenantScopeError2(
-      "UNAUTHENTICATED",
-      401,
-      "Console session required"
-    );
-  }
-  return { tenantId: requested || "default" };
-}
-
 // src/controllers/model-providers.ts
 var logger4 = new Logger({ serviceName: "lattice/gateway/model-providers" });
 function sendError2(reply, error) {
@@ -23094,7 +23244,13 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
           config: lattice.client.getConfig()
         }))
       ),
-      forgetTenantDefaultMiss: (tenantId) => modelLatticeManager3.forgetTenantDefaultMiss(tenantId)
+      forgetTenantDefaultMiss: (tenantId) => modelLatticeManager3.forgetTenantDefaultMiss(tenantId),
+      evictProviderCache: (tenantId, providerId2) => {
+        modelLatticeManager3.evictProviderCache(tenantId, providerId2);
+        embeddingsLatticeManager2.evictProviderCache(tenantId, providerId2);
+        sttModelLatticeManager2.evictProviderCache(tenantId, providerId2);
+        vectorStoreLatticeManager.clearTenantVectorStores(tenantId);
+      }
     },
     onChanged: (tenantId, providerId2) => broadcastModelProviderChanged(tenantId, providerId2)
   }, { authRequired: process.env.AUTH_REQUIRED === "true" });
@@ -25153,7 +25309,7 @@ import { setBindingRegistry, setMenuRegistry, setEvalRunService } from "@axiom-l
 
 // src/channels/wecom/WecomChannelAdapter.ts
 import { randomUUID as randomUUID25 } from "crypto";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 import * as WecomAiBot from "@wecom/aibot-node-sdk";
 
 // src/channels/wecom/parser.ts
@@ -25178,23 +25334,287 @@ function parseWecomTextFrame(frame) {
   };
 }
 
+// src/channels/wecom/cardTool.ts
+import { getToolLattice, registerToolLattice } from "@axiom-lattice/core";
+import { z as z12 } from "zod";
+var CARD_TTL_MS = 10 * 6e4;
+var MAX_CARD_ENTRIES = 1e3;
+var cardEntries = /* @__PURE__ */ new Map();
+function pruneCards(now) {
+  for (const [key, entry] of cardEntries) {
+    if (entry.expiresAt <= now) cardEntries.delete(key);
+  }
+  while (cardEntries.size > MAX_CARD_ENTRIES) {
+    const oldest = cardEntries.keys().next().value;
+    if (oldest === void 0) break;
+    cardEntries.delete(oldest);
+  }
+}
+function putWecomCard(key, card) {
+  const now = Date.now();
+  pruneCards(now);
+  if (cardEntries.get(key)?.closed) return false;
+  cardEntries.delete(key);
+  cardEntries.set(key, { card, expiresAt: now + CARD_TTL_MS, closed: false });
+  return true;
+}
+function takeWecomCard(key) {
+  const now = Date.now();
+  pruneCards(now);
+  const entry = cardEntries.get(key);
+  if (!entry) return void 0;
+  cardEntries.delete(key);
+  cardEntries.set(key, { expiresAt: now + CARD_TTL_MS, closed: true });
+  return entry.card;
+}
+function discardWecomCard(key) {
+  const now = Date.now();
+  pruneCards(now);
+  const entry = cardEntries.get(key);
+  if (entry) entry.card = void 0;
+  cardEntries.delete(key);
+  cardEntries.set(key, { expiresAt: now + CARD_TTL_MS, closed: true });
+}
+var CARD_TYPES = [
+  "text_notice",
+  "news_notice",
+  "button_interaction",
+  "vote_interaction",
+  "multiple_interaction"
+];
+var optionSchema = z12.object({
+  id: z12.string().describe("\u9009\u9879 ID"),
+  text: z12.string().describe("\u9009\u9879\u6587\u6848"),
+  is_checked: z12.boolean().optional().describe("\u662F\u5426\u9ED8\u8BA4\u9009\u4E2D")
+});
+var schema = z12.object({
+  card_type: z12.enum(CARD_TYPES).default("text_notice").describe(
+    "\u5361\u7247\u7C7B\u578B\uFF1Atext_notice(\u6587\u672C\u901A\u77E5)/news_notice(\u56FE\u6587)/button_interaction(\u6309\u94AE)/vote_interaction(\u6295\u7968)/multiple_interaction(\u591A\u9009)"
+  ),
+  title: z12.string().min(1).max(26).describe("\u4E00\u7EA7\u6807\u9898\uFF0C\u4E0D\u8D85\u8FC7 26 \u5B57"),
+  desc: z12.string().max(30).optional().describe("\u6807\u9898\u8F85\u52A9\u4FE1\u606F\uFF0C\u4E0D\u8D85\u8FC7 30 \u5B57"),
+  source_desc: z12.string().max(13).optional().describe("\u5361\u7247\u5DE6\u4E0A\u89D2\u6765\u6E90\u6587\u6848\uFF0C\u4E0D\u8D85\u8FC7 13 \u5B57"),
+  source_color: z12.number().int().min(0).max(3).optional().describe("\u6765\u6E90\u6587\u5B57\u989C\u8272\uFF1A0 \u7070(\u9ED8\u8BA4)/1 \u9ED1/2 \u7EA2/3 \u7EFF"),
+  emphasis_title: z12.string().max(10).optional().describe("\u5173\u952E\u6570\u5B57\uFF0C\u4E0D\u8D85\u8FC7 10 \u5B57"),
+  emphasis_desc: z12.string().max(15).optional().describe("\u5173\u952E\u6570\u5B57\u8BF4\u660E\uFF0C\u4E0D\u8D85\u8FC7 15 \u5B57"),
+  subtitle: z12.string().max(112).optional().describe("\u4E8C\u7EA7\u666E\u901A\u6587\u672C\uFF0C\u4E0D\u8D85\u8FC7 112 \u5B57"),
+  quote_text: z12.string().optional().describe("\u5F15\u7528\u6837\u5F0F\u6587\u672C\uFF08\u4E0E\u5173\u952E\u6570\u5B57\u4E8C\u9009\u4E00\uFF09"),
+  items: z12.array(z12.object({
+    key: z12.string().max(5).describe("\u4E8C\u7EA7\u6807\u9898\uFF0C\u4E0D\u8D85\u8FC7 5 \u5B57"),
+    value: z12.string().max(26).describe("\u4E8C\u7EA7\u6587\u672C\uFF0C\u4E0D\u8D85\u8FC7 26 \u5B57"),
+    url: z12.string().optional().describe("\u70B9\u51FB\u8DF3\u8F6C\u94FE\u63A5\uFF08\u53EF\u9009\uFF09")
+  })).max(6).optional().describe("\u952E\u503C\u660E\u7EC6\u5217\u8868\uFF0C\u6700\u591A 6 \u6761"),
+  links: z12.array(z12.object({
+    title: z12.string().max(13).describe("\u94FE\u63A5\u6587\u6848\uFF0C\u4E0D\u8D85\u8FC7 13 \u5B57"),
+    url: z12.string()
+  })).max(3).optional().describe("\u8DF3\u8F6C\u94FE\u63A5\u5217\u8868\uFF0C\u6700\u591A 3 \u6761"),
+  action_url: z12.string().optional().describe("\u6574\u5F20\u5361\u7247\u70B9\u51FB\u8DF3\u8F6C\u7684\u94FE\u63A5\uFF08\u4F01\u5FAE\u8981\u6C42\u5FC5\u586B\uFF1B\u7F3A\u7701\u65F6\u81EA\u52A8\u53D6\u7B2C\u4E00\u6761 links[].url\uFF09"),
+  // ── news_notice ──────────────────────────────────────────────
+  image_url: z12.string().optional().describe("\u5361\u7247\u56FE\u7247\uFF08news_notice\uFF09"),
+  image_text: z12.object({ title: z12.string(), desc: z12.string().optional(), url: z12.string().optional() }).optional().describe("\u5DE6\u56FE\u53F3\u6587\u533A\u57DF\uFF08news_notice\uFF09"),
+  vertical_items: z12.array(z12.object({ title: z12.string(), desc: z12.string().optional() })).max(4).optional().describe("\u5782\u76F4\u5185\u5BB9\u5217\u8868\uFF0C\u6700\u591A 4 \u6761\uFF08news_notice\uFF09"),
+  // ── button_interaction ───────────────────────────────────────
+  buttons: z12.array(z12.object({
+    text: z12.string().max(4).describe("\u6309\u94AE\u6587\u6848\uFF0C\u4E0D\u8D85\u8FC7 4 \u5B57"),
+    key: z12.string().describe("\u6309\u94AE key\uFF0C\u7528\u4E8E\u56DE\u8C03"),
+    style: z12.number().int().min(1).max(4).optional().describe("\u6309\u94AE\u6837\u5F0F 1-4")
+  })).max(6).optional().describe("\u6309\u94AE\u5217\u8868\uFF0C\u6700\u591A 6 \u6761\uFF08button_interaction\uFF09"),
+  // ── vote_interaction ─────────────────────────────────────────
+  checkbox: z12.object({
+    question_key: z12.string().describe("\u9009\u62E9\u9898 key"),
+    option_list: z12.array(optionSchema).max(20).describe("\u9009\u9879\u5217\u8868\uFF0C\u6700\u591A 20 \u4E2A")
+  }).optional().describe("\u9009\u62E9\u9898\uFF08vote_interaction\uFF09"),
+  submit_text: z12.string().optional().describe("\u63D0\u4EA4\u6309\u94AE\u6587\u6848\uFF0C\u9ED8\u8BA4\u300C\u63D0\u4EA4\u300D"),
+  // ── multiple_interaction ─────────────────────────────────────
+  selections: z12.array(z12.object({
+    question_key: z12.string(),
+    title: z12.string().optional(),
+    option_list: z12.array(optionSchema).max(20)
+  })).max(3).optional().describe("\u4E0B\u62C9\u9009\u62E9\u5668\u5217\u8868\uFF0C\u6700\u591A 3 \u4E2A\uFF08multiple_interaction\uFF09")
+});
+function assertUrl(url, field) {
+  if (url === void 0) return;
+  if (!/^https?:\/\/\S+$/i.test(url)) {
+    throw new Error(`${field} \u5FC5\u987B\u662F http(s):// \u5F00\u5934\u7684\u53EF\u8BBF\u95EE\u94FE\u63A5\uFF0C\u6536\u5230\u300C${url}\u300D`);
+  }
+}
+function newTaskId() {
+  return `wecom-card-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function buildTemplateCard(input) {
+  if (!input.title.trim()) throw new Error("title \u4E0D\u80FD\u4E3A\u7A7A");
+  assertUrl(input.action_url, "action_url");
+  assertUrl(input.image_url, "image_url");
+  input.links?.forEach((link, i) => assertUrl(link.url, `links[${i}].url`));
+  input.items?.forEach((item, i) => assertUrl(item.url, `items[${i}].url`));
+  assertUrl(input.image_text?.url, "image_text.url");
+  const actionUrl = input.action_url ?? input.links?.[0]?.url;
+  if (!actionUrl) {
+    throw new Error(
+      "\u5361\u7247\u5FC5\u987B\u63D0\u4F9B action_url\uFF08\u6574\u5361\u70B9\u51FB\u8DF3\u8F6C\uFF09\uFF0C\u6216\u81F3\u5C11\u4E00\u6761\u5E26 url \u7684 links \u2014\u2014 \u4F01\u5FAE\u8981\u6C42 card_action \u4E0D\u80FD\u4E3A\u7A7A"
+    );
+  }
+  const card = {
+    card_type: input.card_type,
+    main_title: {
+      title: input.title,
+      ...input.desc ? { desc: input.desc } : {}
+    },
+    card_action: { type: 1, url: actionUrl }
+  };
+  if (input.source_desc) {
+    card.source = {
+      desc: input.source_desc,
+      ...input.source_color !== void 0 ? { desc_color: input.source_color } : {}
+    };
+  }
+  if (input.emphasis_title || input.emphasis_desc) {
+    card.emphasis_content = {
+      ...input.emphasis_title ? { title: input.emphasis_title } : {},
+      ...input.emphasis_desc ? { desc: input.emphasis_desc } : {}
+    };
+  }
+  if (input.subtitle) card.sub_title_text = input.subtitle;
+  if (input.quote_text) card.quote_area = { type: 0, quote_text: input.quote_text };
+  if (input.items?.length) {
+    card.horizontal_content_list = input.items.map((item) => ({
+      type: item.url ? 1 : 0,
+      keyname: item.key,
+      value: item.value,
+      ...item.url ? { url: item.url } : {}
+    }));
+  }
+  if (input.links?.length) {
+    card.jump_list = input.links.map((link) => ({
+      type: 1,
+      url: link.url,
+      title: link.title
+    }));
+  }
+  if (input.card_type === "news_notice") {
+    if (input.image_url) card.card_image = { url: input.image_url };
+    if (input.image_text) {
+      card.image_text_area = {
+        type: input.image_text.url ? 1 : 0,
+        ...input.image_text.url ? { url: input.image_text.url } : {},
+        title: input.image_text.title,
+        ...input.image_text.desc ? { desc: input.image_text.desc } : {}
+      };
+    }
+    if (input.vertical_items?.length) {
+      card.vertical_content_list = input.vertical_items.map((item) => ({
+        title: item.title,
+        ...item.desc ? { desc: item.desc } : {}
+      }));
+    }
+  }
+  if (input.card_type === "button_interaction") {
+    if (!input.buttons?.length) throw new Error("button_interaction \u5FC5\u987B\u63D0\u4F9B buttons");
+    card.button_list = input.buttons.map((button) => ({
+      text: button.text,
+      key: button.key,
+      ...button.style !== void 0 ? { style: button.style } : {}
+    }));
+    card.task_id = newTaskId();
+  }
+  if (input.card_type === "vote_interaction") {
+    if (!input.checkbox) throw new Error("vote_interaction \u5FC5\u987B\u63D0\u4F9B checkbox");
+    card.checkbox = {
+      question_key: input.checkbox.question_key,
+      option_list: input.checkbox.option_list.map((option) => ({
+        id: option.id,
+        text: option.text,
+        ...option.is_checked !== void 0 ? { is_checked: option.is_checked } : {}
+      }))
+    };
+    card.submit_button = { text: input.submit_text ?? "\u63D0\u4EA4", type: 1, key: "submit" };
+    card.task_id = newTaskId();
+  }
+  if (input.card_type === "multiple_interaction") {
+    if (!input.selections?.length) throw new Error("multiple_interaction \u5FC5\u987B\u63D0\u4F9B selections");
+    card.select_list = input.selections.map((selection) => ({
+      question_key: selection.question_key,
+      ...selection.title ? { title: selection.title } : {},
+      option_list: selection.option_list.map((option) => ({
+        id: option.id,
+        text: option.text,
+        ...option.is_checked !== void 0 ? { is_checked: option.is_checked } : {}
+      }))
+    }));
+    card.submit_button = { text: input.submit_text ?? "\u63D0\u4EA4", type: 1, key: "submit" };
+    card.task_id = newTaskId();
+  }
+  return card;
+}
+function readReplyKey(exeConfig) {
+  const configurable = exeConfig?.configurable;
+  const key = configurable?.runConfig?.wecomReplyKey;
+  return typeof key === "string" && key.length > 0 ? key : void 0;
+}
+function registerWecomCardTool() {
+  if (getToolLattice("wecom_card")) return;
+  registerToolLattice(
+    "wecom_card",
+    {
+      name: "wecom_card",
+      description: "\u5728**\u4F01\u4E1A\u5FAE\u4FE1\u4F1A\u8BDD**\u4E2D\uFF0C\u628A\u672C\u8F6E\u56DE\u590D\u7684\u6838\u5FC3\u7ED3\u679C\u505A\u6210\u4E00\u5F20\u6A21\u677F\u5361\u7247\uFF0C\u5361\u7247\u4F1A\u5728\u672C\u6761\u56DE\u590D\u540E\u7531\u6E20\u9053\u81EA\u52A8\u53D1\u9001\u3002\n\n\u4E3B\u52A8\u4F7F\u7528\uFF08\u7528\u6237\u4E0D\u9700\u8981\u8BF4\u300C\u5361\u7247\u300D\u300C\u5361\u7247\u6D88\u606F\u300D\uFF09\uFF1A\u5F53\u56DE\u590D\u7684\u4E3B\u8981\u4EF7\u503C\u662F\u7ED3\u6784\u5316\u4E1A\u52A1\u5BF9\u8C61\u65F6 \u2014\u2014 \u5BA2\u6237\u4EA4\u63A5/\u6D3E\u5355\u3001\u544A\u8B66/\u5F02\u5E38/\u98CE\u9669\u3001\u6E05\u5355/\u6838\u5BF9\u8868\u3001\u5F85\u529E/\u884C\u52A8\u9879\u3001\u72B6\u6001/\u8FDB\u5EA6/\u6307\u6807\u6C47\u603B\u3001\u6295\u7968/\u9009\u62E9/\u786E\u8BA4\u3001\u9700\u8981\u70B9\u51FB\u8FDB\u5165\u7684\u94FE\u63A5/\u516C\u544A\u5165\u53E3\u3002\u53EA\u8981\u7ED3\u679C\u5177\u5907\u300C\u6807\u9898 + 1-6 \u6761\u952E\u503C\u660E\u7EC6\uFF08\u6216\u9009\u9879\uFF09+ \u4E00\u4E2A\u53EF\u8DF3\u8F6C\u94FE\u63A5\u300D\uFF0C\u5C31\u5E94\u8C03\u7528\u3002\n\n\u4E0D\u8981\u4F7F\u7528\uFF1A\u666E\u901A\u95EE\u7B54\u3001\u89E3\u91CA\u3001\u95F2\u804A\u3001\u957F\u6587\u5206\u6790\u3001\u4EE3\u7801\u3001\u6CA1\u6709\u660E\u786E\u8DF3\u8F6C\u76EE\u6807\u7684\u5BF9\u8BDD\u3001\u4E00\u53E5\u8BDD\u5C31\u80FD\u8BF4\u6E05\u7684\u7ED3\u679C\u3002\n\n\u8C03\u7528\u540E\u4ECD\u7528\u4E00\u4E24\u53E5\u8BDD\u603B\u7ED3\u7ED3\u8BBA\uFF1B\u4E0D\u8981\u518D\u8F93\u51FA JSON\uFF0C\u4E5F\u4E0D\u8981\u5199\u3010\u5361\u7247\u6D88\u606F\u3011\u3002\u6BCF\u6761\u56DE\u590D\u6700\u591A\u4E00\u5F20\u5361\u7247\uFF0C\u91CD\u590D\u8C03\u7528\u4F1A\u66FF\u6362\u4E0A\u4E00\u5F20\u3002\u8FD4\u56DE ERROR \u65F6\u6309\u63D0\u793A\u4FEE\u6B63\u540E\u91CD\u8BD5\uFF0C\u4E0D\u8981\u628A ERROR \u653E\u8FDB\u56DE\u590D\u3002\u5B50 agent \u4E0D\u8981\u8C03\u7528\u672C\u5DE5\u5177\u3002",
+      schema
+    },
+    async (input, exeConfig) => {
+      const replyKey = readReplyKey(exeConfig);
+      if (!replyKey) {
+        return "ERROR: wecom_card \u53EA\u80FD\u5728\u4F01\u4E1A\u5FAE\u4FE1\u5B9E\u65F6\u4F1A\u8BDD\u4E2D\u4F7F\u7528\uFF0C\u8BF7\u76F4\u63A5\u7528\u6587\u5B57\u56DE\u590D\u3002";
+      }
+      try {
+        const card = buildTemplateCard(input);
+        if (!putWecomCard(replyKey, card)) {
+          return "ERROR: \u672C\u6761\u56DE\u590D\u5DF2\u7ED3\u675F\uFF0C\u65E0\u6CD5\u518D\u9644\u5E26\u5361\u7247\u3002\u8BF7\u628A\u7ED3\u679C\u5199\u5165\u6B63\u6587\u3002";
+        }
+        const title = card.main_title?.title;
+        const suffix = typeof title === "string" && title ? `\u300C${title}\u300D` : "";
+        return `\u5DF2\u751F\u6210\u4F01\u4E1A\u5FAE\u4FE1\u5361\u7247${suffix}\uFF0C\u5C06\u968F\u672C\u6761\u56DE\u590D\u81EA\u52A8\u53D1\u9001\u3002\u8BF7\u7528\u6587\u5B57\u603B\u7ED3\u7ED3\u8BBA\uFF0C\u4E0D\u8981\u91CD\u590D\u5361\u7247\u5185\u5BB9\u3002`;
+      } catch (error) {
+        return `ERROR: ${error instanceof Error ? error.message : String(error)}\u3002\u8BF7\u4FEE\u6B63\u53C2\u6570\u540E\u91CD\u65B0\u8C03\u7528 wecom_card\u3002`;
+      }
+    }
+  );
+}
+
 // src/channels/wecom/WecomChannelAdapter.ts
 var logger6 = new Logger({ serviceName: "lattice/gateway/wecom" });
-var wecomConfigSchema = z12.object({
-  botId: z12.string(),
-  secret: z12.string()
+var wecomConfigSchema = z13.object({
+  botId: z13.string(),
+  secret: z13.string()
 });
 var RECONNECT_BASE_MS = 5e3;
 var RECONNECT_MAX_MS = 6e4;
+var SENT_CARD_TTL_MS = 10 * 6e4;
+var MAX_SENT_CARDS = 1e3;
 var activeConnections2 = /* @__PURE__ */ new Map();
 var streamIdsByReqId = /* @__PURE__ */ new Map();
 var MAX_TRACKED_STREAMS = 1e3;
-function streamKeyOf(replyTarget) {
-  const frame = replyTarget.rawTarget.frame;
-  return frame?.headers?.req_id ?? replyTarget.channelInstallationId;
+var sentCardsByTaskId = /* @__PURE__ */ new Map();
+var handledCardEventKeys = /* @__PURE__ */ new Map();
+var ACKNOWLEDGED_TTL_MS = 10 * 6e4;
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function replyKeyOf(installationId, reqId) {
+  return `${installationId}:${reqId ?? "no-req"}`;
+}
+function replyKeyForTarget(replyTarget) {
+  const frame = replyTarget.rawTarget?.frame;
+  return replyKeyOf(replyTarget.channelInstallationId, frame?.headers?.req_id);
+}
+function isEventReplyTarget(replyTarget) {
+  return replyTarget.rawTarget?.kind === "template_card_event";
+}
+function eventChatId(replyTarget) {
+  const chatId = replyTarget.rawTarget?.chatId;
+  return typeof chatId === "string" && chatId.length > 0 ? chatId : void 0;
 }
 function streamIdFor(replyTarget) {
-  const key = streamKeyOf(replyTarget);
+  const key = replyKeyForTarget(replyTarget);
   let streamId = streamIdsByReqId.get(key);
   if (!streamId) {
     streamId = randomUUID25();
@@ -25206,6 +25626,267 @@ function streamIdFor(replyTarget) {
   }
   return streamId;
 }
+function rememberSentCard(card) {
+  const taskId = typeof card.task_id === "string" ? card.task_id : void 0;
+  if (!taskId) return;
+  const now = Date.now();
+  for (const [key, entry] of sentCardsByTaskId) {
+    if (entry.expiresAt <= now) sentCardsByTaskId.delete(key);
+  }
+  sentCardsByTaskId.set(taskId, { card, expiresAt: now + SENT_CARD_TTL_MS });
+  while (sentCardsByTaskId.size > MAX_SENT_CARDS) {
+    const oldest = sentCardsByTaskId.keys().next().value;
+    if (oldest === void 0) break;
+    sentCardsByTaskId.delete(oldest);
+  }
+}
+function sentCardForTask(taskId) {
+  if (!taskId) return void 0;
+  const entry = sentCardsByTaskId.get(taskId);
+  if (!entry) return void 0;
+  if (entry.expiresAt <= Date.now()) {
+    sentCardsByTaskId.delete(taskId);
+    return void 0;
+  }
+  return entry.card;
+}
+function claimCardEvent(taskId, eventKey) {
+  if (!taskId) return true;
+  const key = `${taskId}:${eventKey ?? ""}`;
+  const now = Date.now();
+  for (const [handled, expiresAt] of handledCardEventKeys) {
+    if (expiresAt <= now) handledCardEventKeys.delete(handled);
+  }
+  if (handledCardEventKeys.has(key)) return false;
+  handledCardEventKeys.set(key, now + ACKNOWLEDGED_TTL_MS);
+  while (handledCardEventKeys.size > MAX_SENT_CARDS) {
+    const oldest = handledCardEventKeys.keys().next().value;
+    if (oldest === void 0) break;
+    handledCardEventKeys.delete(oldest);
+  }
+  return true;
+}
+async function sendStreamFrame(connection, replyTarget, input) {
+  if (isEventReplyTarget(replyTarget)) {
+    await sendEventReply(connection, replyTarget, input);
+    return;
+  }
+  const frame = replyTarget.rawTarget?.frame;
+  if (!frame) {
+    logger6.warn("WeCom reply target has no inbound frame, skipping", {
+      installationId: replyTarget.channelInstallationId
+    });
+    return;
+  }
+  const report = (message, error) => logger6.warn(message, {
+    installationId: replyTarget.channelInstallationId,
+    error: error instanceof Error ? error.message : String(error)
+  });
+  const text = input.text || (input.done ? input.card ? "\u5DF2\u5B8C\u6210\uFF0C\u8BE6\u60C5\u89C1\u4E0B\u65B9\u5361\u7247\u3002" : "\u5904\u7406\u5B8C\u6210\u3002" : "");
+  if (!text) return;
+  try {
+    await Promise.resolve(connection.client.reply(frame, {
+      msgtype: "stream",
+      stream: { id: streamIdFor(replyTarget), finish: input.done, content: text }
+    }));
+  } catch (error) {
+    report("WeCom stream reply failed", error);
+  }
+  if (input.done && input.card) {
+    try {
+      await Promise.resolve(connection.client.reply(frame, {
+        msgtype: "template_card",
+        template_card: input.card
+      }));
+      rememberSentCard(input.card);
+      logger6.info("WeCom card sent", {
+        installationId: replyTarget.channelInstallationId,
+        cardType: input.card.card_type
+      });
+    } catch (error) {
+      report("WeCom card reply failed (text already sent)", error);
+    }
+  }
+}
+async function sendEventReply(connection, replyTarget, input) {
+  if (!input.done) return;
+  const chatId = eventChatId(replyTarget);
+  if (!chatId) {
+    logger6.warn("WeCom card event has no chat id, cannot reply", {
+      installationId: replyTarget.channelInstallationId
+    });
+    return;
+  }
+  const sendMessage = connection.client.sendMessage;
+  if (!sendMessage) {
+    logger6.warn("WeCom client does not support sendMessage, cannot reply to card event", {
+      installationId: replyTarget.channelInstallationId
+    });
+    return;
+  }
+  const report = (message, error) => logger6.warn(message, {
+    installationId: replyTarget.channelInstallationId,
+    error: error instanceof Error ? error.message : String(error)
+  });
+  if (input.card) {
+    try {
+      await Promise.resolve(sendMessage.call(connection.client, chatId, {
+        msgtype: "template_card",
+        template_card: input.card
+      }));
+      rememberSentCard(input.card);
+      logger6.info("WeCom card sent", {
+        installationId: replyTarget.channelInstallationId,
+        cardType: input.card.card_type
+      });
+    } catch (error) {
+      report("WeCom card event card failed", error);
+    }
+    return;
+  }
+  if (input.text) {
+    try {
+      await Promise.resolve(sendMessage.call(connection.client, chatId, {
+        msgtype: "markdown",
+        markdown: { content: input.text }
+      }));
+    } catch (error) {
+      report("WeCom card event reply failed", error);
+    }
+  }
+}
+function acknowledgedCard(taskId, eventKey) {
+  const desc = eventKey ? `\u5DF2\u6536\u5230\uFF1A${eventKey}` : "\u5DF2\u63D0\u4EA4\uFF0C\u6B63\u5728\u5904\u7406\u2026";
+  const original = sentCardForTask(taskId);
+  if (original) {
+    const mainTitle = isRecord4(original.main_title) ? original.main_title : {};
+    return { ...original, main_title: { ...mainTitle, desc } };
+  }
+  return {
+    card_type: "text_notice",
+    main_title: { title: "\u5DF2\u6536\u5230\u4F60\u7684\u64CD\u4F5C", desc },
+    ...taskId ? { task_id: taskId } : {}
+  };
+}
+function cardEventFields(event) {
+  const nested = isRecord4(event?.template_card_event) ? event.template_card_event : event;
+  const source = nested ?? {};
+  return {
+    cardEvent: source,
+    taskId: typeof source.task_id === "string" ? source.task_id : void 0,
+    eventKey: typeof source.event_key === "string" ? source.event_key : void 0,
+    cardType: typeof source.card_type === "string" ? source.card_type : void 0
+  };
+}
+function describeError(error) {
+  if (error instanceof Error) return error.message;
+  if (typeof error === "string") return error;
+  try {
+    return JSON.stringify(error);
+  } catch {
+    return String(error);
+  }
+}
+function cardEventInbound(frame, installation, input) {
+  const body = frame.body;
+  const { cardEvent, taskId, eventKey, cardType } = cardEventFields(body.event);
+  const summary = eventKey ? `\u7528\u6237\u70B9\u51FB\u4E86\u5361\u7247\u6309\u94AE\u300C${eventKey}\u300D${taskId ? `\uFF08task_id=${taskId}\uFF09` : ""}` : `\u7528\u6237\u63D0\u4EA4\u4E86\u5361\u7247\u64CD\u4F5C${taskId ? `\uFF08task_id=${taskId}\uFF09` : ""}\uFF1A${JSON.stringify(cardEvent)}`;
+  return {
+    channel: "wecom",
+    channelInstallationId: installation.id,
+    tenantId: installation.tenantId,
+    sender: { id: input.userId },
+    content: {
+      text: summary,
+      metadata: {
+        messageId: body.msgid,
+        chatId: input.chatId,
+        chatType: body.chattype === "group" ? "group" : "direct",
+        taskId,
+        eventKey,
+        cardType,
+        cardEvent,
+        wecomReplyKey: replyKeyOf(installation.id, frame.headers.req_id)
+      }
+    },
+    conversation: {
+      id: input.chatId,
+      type: body.chattype === "group" ? "group" : "direct"
+    },
+    replyTarget: {
+      adapterChannel: "wecom",
+      channelInstallationId: installation.id,
+      rawTarget: { kind: "template_card_event", frame, chatId: input.chatId }
+    }
+  };
+}
+function handleTemplateCardEvent(rawFrame, installation, client, router) {
+  const frame = rawFrame;
+  const body = frame?.body;
+  const event = body?.event;
+  const reqId = frame?.headers?.req_id;
+  if (!body || event?.eventtype !== "template_card_event" || typeof reqId !== "string") {
+    return;
+  }
+  const userId = body.from?.userid;
+  const chatId = typeof body.chatid === "string" && body.chatid ? body.chatid : userId;
+  if (!userId || !chatId) {
+    logger6.warn("WeCom card event missing user/chat id, skipping", {
+      installationId: installation.id
+    });
+    return;
+  }
+  const { taskId, eventKey } = cardEventFields(event);
+  if (!claimCardEvent(taskId, eventKey)) {
+    logger6.info("WeCom duplicate card event ignored", {
+      installationId: installation.id,
+      taskId,
+      eventKey
+    });
+    return;
+  }
+  const updateTemplateCard = client.updateTemplateCard;
+  if (updateTemplateCard) {
+    const updated = acknowledgedCard(taskId, eventKey);
+    try {
+      void Promise.resolve(updateTemplateCard.call(client, rawFrame, updated)).catch((error) => {
+        logger6.warn("WeCom template card update failed", {
+          installationId: installation.id,
+          error: describeError(error)
+        });
+      });
+    } catch (error) {
+      logger6.warn("WeCom template card update failed", {
+        installationId: installation.id,
+        error: describeError(error)
+      });
+    }
+  } else {
+    logger6.warn("WeCom client does not support updateTemplateCard", {
+      installationId: installation.id
+    });
+  }
+  if (!router) return;
+  logger6.info("WeCom card event dispatched", {
+    installationId: installation.id,
+    taskId,
+    eventKey,
+    chatId
+  });
+  try {
+    void router.dispatch(cardEventInbound(frame, installation, { chatId, userId })).catch((error) => {
+      logger6.error("WeCom card event dispatch error", {
+        installationId: installation.id,
+        error: describeError(error)
+      });
+    });
+  } catch (error) {
+    logger6.error("WeCom card event dispatch error", {
+      installationId: installation.id,
+      error: describeError(error)
+    });
+  }
+}
 var wecomChannelAdapter = {
   channel: "wecom",
   configSchema: wecomConfigSchema,
@@ -25219,11 +25900,13 @@ var wecomChannelAdapter = {
       sender: { id: parsed.fromUserId },
       content: {
         text: parsed.text,
-        // `messageId` 供去重中间件使用（企业微信可能重投同一 msgid）。
+        // `messageId` 供去重中间件使用（企业微信可能重投同一 msgid）；
+        // `wecomReplyKey` 供 `wecom_card` 工具登记本轮卡片。
         metadata: {
           messageId: parsed.msgId,
           chatId: parsed.chatId,
-          chatType: parsed.chatType
+          chatType: parsed.chatType,
+          wecomReplyKey: replyKeyOf(installation.id, parsed.reqId)
         }
       },
       conversation: {
@@ -25247,14 +25930,12 @@ var wecomChannelAdapter = {
       });
       return;
     }
-    const key = streamKeyOf(replyTarget);
-    connection.client.reply(replyTarget.rawTarget.frame, {
-      msgtype: "stream",
-      stream: {
-        id: streamIdFor(replyTarget),
-        finish: true,
-        content: message.text
-      }
+    const key = replyKeyForTarget(replyTarget);
+    const card = takeWecomCard(key);
+    await sendStreamFrame(connection, replyTarget, {
+      text: message.text,
+      done: true,
+      card
     });
     streamIdsByReqId.delete(key);
   },
@@ -25273,15 +25954,21 @@ var wecomChannelAdapter = {
       });
       return;
     }
-    connection.client.reply(replyTarget.rawTarget.frame, {
-      msgtype: "stream",
-      stream: {
-        id: streamIdFor(replyTarget),
-        finish: chunk.done,
-        content: chunk.text
+    const key = replyKeyForTarget(replyTarget);
+    let card;
+    if (chunk.done) {
+      if (chunk.reason !== void 0 && chunk.reason !== "completed") {
+        discardWecomCard(key);
+      } else {
+        card = takeWecomCard(key);
       }
+    }
+    await sendStreamFrame(connection, replyTarget, {
+      text: chunk.text,
+      done: chunk.done,
+      card
     });
-    if (chunk.done) streamIdsByReqId.delete(streamKeyOf(replyTarget));
+    if (chunk.done) streamIdsByReqId.delete(key);
   },
   resolveThreadId(message, binding) {
     const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
@@ -25315,6 +26002,9 @@ var wecomChannelAdapter = {
         });
       });
     });
+    client.on("event.template_card_event", (frame) => {
+      handleTemplateCardEvent(frame, installation, client, router);
+    });
     client.on("authenticated", () => {
       connection.attempts = 0;
     });
@@ -25811,6 +26501,9 @@ import {
   agentLatticeManager as agentLatticeManager5,
   configurePluginCatalogSync,
   PLUGIN_CATALOG_CHANGED_TOPIC,
+  configureCollectionSync,
+  COLLECTION_CHANGED_TOPIC,
+  vectorStoreLatticeManager as vectorStoreLatticeManager2,
   getSandboxPluginCatalog as getSandboxPluginCatalog3,
   getSandBoxManager as getSandBoxManager4,
   installPluginHost
@@ -25843,6 +26536,7 @@ var ChannelInstallationNotFoundError = class extends Error {
   }
 };
 var DEFAULT_STREAM_PLACEHOLDER = "\u6B63\u5728\u5904\u7406\u2026";
+var DEFAULT_STREAM_FAILURE_TEXT = "\u5904\u7406\u672A\u5B8C\u6210\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002";
 function streamPlaceholderFor(installation) {
   const config = installation?.config;
   if (config !== null && typeof config === "object" && !Array.isArray(config)) {
@@ -25851,6 +26545,14 @@ function streamPlaceholderFor(installation) {
   }
   return DEFAULT_STREAM_PLACEHOLDER;
 }
+function streamFailureTextFor(installation) {
+  const config = installation?.config;
+  if (config !== null && typeof config === "object" && !Array.isArray(config)) {
+    const value = config.streamFailureText;
+    if (typeof value === "string") return value;
+  }
+  return DEFAULT_STREAM_FAILURE_TEXT;
+}
 var InvalidChannelInstallationError = class extends Error {
   constructor(message = "Channel installation is not valid for this message") {
     super(message);
@@ -26262,7 +26964,13 @@ var _MessageRouter = class _MessageRouter {
             if (cleaned || !event.consumedInputMessageIds.includes(inputMessageId)) return;
             cleanup();
             if (event.inputMessageId !== inputMessageId) return;
-            const delivery = replyAdapter.sendStreamChunk ? streamState.finished ? void 0 : replyAdapter.sendStreamChunk(replyTarget, { text: event.outputText, done: true }, installation) : replyAdapter.sendReply(replyTarget, {
+            if (replyAdapter.sendStreamChunk && streamState.finished) return;
+            if (replyAdapter.sendStreamChunk) streamState.finished = true;
+            const delivery = replyAdapter.sendStreamChunk ? replyAdapter.sendStreamChunk(
+              replyTarget,
+              { text: event.outputText, done: true, reason: "completed" },
+              installation
+            ) : replyAdapter.sendReply(replyTarget, {
               text: event.outputText,
               metadata: { inputMessageId, outputMessageId: event.outputMessageId }
             }, installation);
@@ -26386,17 +27094,34 @@ var _MessageRouter = class _MessageRouter {
     const send = adapter.sendStreamChunk;
     if (!send) return;
     let started = false;
+    let normalEnd = false;
     let accumulated = "";
     let lastSentText = "";
     let lastSentAt = 0;
     let sent = 0;
     const warn = (event, error) => console.warn({ event, inputMessageId, error: error instanceof Error ? error.message : String(error) });
-    const push = (text, done) => send.call(adapter, replyTarget, { text, done }, installation).catch((error) => warn("dispatch:stream:failed", error));
+    const push = (text, done, reason) => send.call(
+      adapter,
+      replyTarget,
+      reason ? { text, done, reason } : { text, done },
+      installation
+    ).catch((error) => warn("dispatch:stream:failed", error));
     const placeholder = streamPlaceholderFor(installation);
+    const closeWith = async (reason) => {
+      if (state.finished) return;
+      state.finished = true;
+      const text = accumulated || (reason === "completed" ? "" : streamFailureTextFor(installation) || placeholder);
+      await push(text, true, reason);
+    };
+    const timer = setTimeout(() => {
+      void closeWith("timeout");
+    }, _MessageRouter.STREAM_TIMEOUT_MS);
+    timer.unref?.();
     try {
       if (placeholder) await push(placeholder, false);
       const stream = agent.chunkStream(inputMessageId, []);
       for await (const chunk of stream) {
+        if (state.finished) break;
         if (!started) {
           if (chunk?.type === MessageChunkTypes4.HUMAN && chunk?.data?.id === inputMessageId) {
             started = true;
@@ -26404,12 +27129,19 @@ var _MessageRouter = class _MessageRouter {
           continue;
         }
         if (chunk?.type === MessageChunkTypes4.MESSAGE_COMPLETED || chunk?.type === MessageChunkTypes4.MESSAGE_FAILED || chunk?.type === MessageChunkTypes4.INTERRUPT) {
-          if (chunk.type !== MessageChunkTypes4.MESSAGE_COMPLETED) {
-            const text2 = accumulated || placeholder;
-            if (text2) {
-              await push(text2, true);
-              state.finished = true;
-            }
+          if (chunk.type === MessageChunkTypes4.MESSAGE_COMPLETED) {
+            normalEnd = true;
+            const grace = setTimeout(
+              () => {
+                void closeWith("completed");
+              },
+              _MessageRouter.COMPLETION_GRACE_MS
+            );
+            grace.unref?.();
+          } else if (chunk.type === MessageChunkTypes4.MESSAGE_FAILED) {
+            await closeWith("failed");
+          } else {
+            await closeWith("interrupted");
           }
           break;
         }
@@ -26429,7 +27161,11 @@ var _MessageRouter = class _MessageRouter {
       }
     } catch (error) {
       warn("dispatch:stream:error", error);
+      await closeWith("failed");
+    } finally {
+      clearTimeout(timer);
     }
+    if (!normalEnd) await closeWith("failed");
   }
   /**
    * Projects a pending HITL interrupt into the room as an independent bot message.
@@ -26454,15 +27190,30 @@ var _MessageRouter = class _MessageRouter {
     }
   }
 };
-/** 流式中途刷新的节流间隔与上限（微信单会话 30 条/分钟，留余量）。 */
-_MessageRouter.STREAM_CHUNK_INTERVAL_MS = 800;
-_MessageRouter.MAX_STREAM_CHUNKS = 60;
+/**
+ * 流式中途刷新的节流间隔与上限。
+ *
+ * 企业微信单会话限制 30 条/分钟（含占位、收尾和卡片）。2500ms 约 24 次
+ * 刷新/分钟，再加最多 3 条生命周期消息仍留有余量。
+ */
+_MessageRouter.STREAM_CHUNK_INTERVAL_MS = 2500;
+_MessageRouter.MAX_STREAM_CHUNKS = 190;
+/** 流式回复的硬超时：企微要求 10 分钟内 `finish=true`，留 2 分钟余量。 */
+_MessageRouter.STREAM_TIMEOUT_MS = 8 * 6e4;
+/**
+ * `MESSAGE_COMPLETED` 后等待 `reply:ready` 的宽限。
+ *
+ * 正常完成通常由 `reply:ready` 用权威全文收尾；但最终 AI 消息为空时
+ * （例如模型只调用了 `wecom_card`、没有产出文字）不会触发 `reply:ready`，
+ * 这里兜底自行收尾，避免流挂住、卡片丢失。
+ */
+_MessageRouter.COMPLETION_GRACE_MS = 3e3;
 var MessageRouter = _MessageRouter;
 
 // src/channels/room/RoomChannelAdapter.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 import { snapshotExactRecord as snapshotExactRecord16 } from "@axiom-lattice/protocols";
-var roomConfigSchema = z13.object({}).strict();
+var roomConfigSchema = z14.object({}).strict();
 function createRoomChannelAdapter(writer) {
   return {
     channel: "room",
@@ -26624,7 +27375,7 @@ var PluginDeploymentError = class extends Error {
     this.code = code;
   }
 };
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function buildBootstrapEntrypoint(pluginType) {
@@ -27178,7 +27929,7 @@ var PluginDeploymentService = class {
         return { ok: false, error: `health responded with HTTP ${response.status}` };
       }
       const body = await response.json().catch(() => void 0);
-      if (isRecord4(body) && body.ok === true) {
+      if (isRecord5(body) && body.ok === true) {
         return { ok: true };
       }
       return { ok: false, error: "health returned an invalid envelope" };
@@ -27825,6 +28576,7 @@ var start = async (config) => {
     const adapterRegistry = new ChannelAdapterRegistry();
     adapterRegistry.register(larkChannelAdapter);
     adapterRegistry.register(wecomChannelAdapter);
+    registerWecomCardTool();
     const { wechatChannelAdapter } = await import("./WechatChannelAdapter-7WHE5UGY.mjs");
     adapterRegistry.register(wechatChannelAdapter);
     try {
@@ -28059,6 +28811,7 @@ var start = async (config) => {
     taskLifecycleNotifier3.setOutbox(outboxStore);
     projectTaskAdmissionNotifier2.setOutbox(outboxStore);
     configurePluginCatalogSync({ outbox: outboxStore, owner: getReplicaId7() });
+    configureCollectionSync({ outbox: outboxStore, owner: getReplicaId7() });
     bridgeAssistantEvents(
       (event, cb) => eventBus4.subscribe(event, cb),
       outboxStore,
@@ -28089,6 +28842,12 @@ var start = async (config) => {
           manager: mcpManager3,
           convertToConnection: convertToConnection2
         }),
+        [COLLECTION_CHANGED_TOPIC]: async (payload) => {
+          const tenantId = payload?.tenantId;
+          if (typeof tenantId === "string" && tenantId.length > 0) {
+            vectorStoreLatticeManager2.clearTenantVectorStores(tenantId);
+          }
+        },
         [PLUGIN_CATALOG_CHANGED_TOPIC]: async (payload) => {
           const tenantId = payload?.tenantId;
           if (typeof tenantId === "string" && tenantId.length > 0) {